diff options
| -rw-r--r-- | drivers/staging/ozwpan/ozusbsvc1.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c index d434d8c6fff6..b573ad3e9674 100644 --- a/drivers/staging/ozwpan/ozusbsvc1.c +++ b/drivers/staging/ozwpan/ozusbsvc1.c | |||
| @@ -390,10 +390,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt) | |||
| 390 | case OZ_GET_DESC_RSP: { | 390 | case OZ_GET_DESC_RSP: { |
| 391 | struct oz_get_desc_rsp *body = | 391 | struct oz_get_desc_rsp *body = |
| 392 | (struct oz_get_desc_rsp *)usb_hdr; | 392 | (struct oz_get_desc_rsp *)usb_hdr; |
| 393 | int data_len = elt->length - | 393 | u16 offs, total_size; |
| 394 | sizeof(struct oz_get_desc_rsp) + 1; | 394 | u8 data_len; |
| 395 | u16 offs = le16_to_cpu(get_unaligned(&body->offset)); | 395 | |
| 396 | u16 total_size = | 396 | if (elt->length < sizeof(struct oz_get_desc_rsp) - 1) |
| 397 | break; | ||
| 398 | data_len = elt->length - | ||
| 399 | (sizeof(struct oz_get_desc_rsp) - 1); | ||
| 400 | offs = le16_to_cpu(get_unaligned(&body->offset)); | ||
| 401 | total_size = | ||
| 397 | le16_to_cpu(get_unaligned(&body->total_size)); | 402 | le16_to_cpu(get_unaligned(&body->total_size)); |
| 398 | oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n"); | 403 | oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n"); |
| 399 | oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, | 404 | oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id, |